What’s Vulnerable › Vulnerabilities
CVE-2026-103994: Junos OS: A crafted OVSDB message crashes vgd and allows remote code execution
- Severity: high (CVSS 8.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.4% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-10-14 · updated 2026-10-15
- Weakness: CWE-122
Description
A Heap-based Buffer Overflow vulnerability in the VXLAN Gateway Daemon (vgd) of Juniper Networks Junos OS allows a malicious or compromised SDN-controller to cause a complete outage of the OVSDB control plane and possibly remote code execution.
Affected products
- Juniper Junos OS: before 23.2R2-S7.7; from 23.4 before 23.4R2-S8.13; from 24.2 before 24.2R2-S5.5; from 24.4 before 24.4R2-S5; from 25.2 before 25.2R2-S2; from 25.4 before 25.4R1-S3 — fixed in 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3
How to fix
Upgrade to a fixed version: Juniper Junos OS 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-103994 or the next vulnerability affects your stack